Is it possible to add wildcards or something that would function like them to a snort rule IP address?
For example:
If I'd like to detect source-ip of: 192.168.*.9
Where the third octet can be anything in range 1-255, but the fourth octet has to be exactly '9'.
Snort doesn't support wildcards or regular expressions on IP addresses/ranges. It does support CIDR notation for IP ranges, a few pre-configured variables in snort.conf like $HOME_NET and similar, and a ! for IP or IP range negation (edit: Oh, and of course any, but not !any).
What you could do however is to define a new ipvar variable, fill it with the list of IPs that match your requirements, and then refer to it in the rules definition to simplify things and avoid adding 256 individual rules:
ipvar ENDS_WITH_A_NINE [192.168.0.9,192.168.1.9,192.168.2.9,192.168.3.9,192.168.4.9, ... ]
alert tcp $ENDS_WITH_A_NINE any -> any any (msg:"Last octet of 9 detected!"; sid:9;)
This way, it will be a lot easier to maintain your Snort rules. I realize it doesn't look elegant, but it shouldn't take you longer than a few minutes to copy all the 256 possible IP addresses in the variable list, and beats creating all 256 rules, then later realizing you need to change something in them.
Anyway, hope this helps! ;)
